Exagen (XGN) Risk Factors

Because we have limited financial and managerial resources, we focus on specific testing products. As a result, we may forego or delay pursuit of opportunities with others that could have had greater commercial potential. Our resource allocation decisions may cause us to fail to capitalize on viable commercial products or profitable market opportunities. In addition, our spending on current and future research and development programs for testing products may not yield any commercially viable testing products. If we do not accurately evaluate the commercial potential or target market for a potential testing product, we may forego other similar arrangements which would have been more advantageous for us to pursue.

At times, we share our proprietary technology and confidential information, including trade secrets, with third parties that conduct studies and other services on our behalf. We seek to protect our proprietary technology, in part, by entering into confidentiality agreements, consulting agreements or other similar agreements with our advisors, employees and consultants prior to beginning research or disclosing proprietary information. These agreements typically limit the rights of the third parties to use or disclose our confidential information. Despite the contractual provisions employed when working with third parties, the need to share trade secrets and other confidential information increases the risk that such trade secrets become known by our competitors, are intentionally or inadvertently incorporated into the technology of others or are disclosed or used in violation of these agreements. Given that our proprietary position is based, in part, on our know-how and trade secrets and despite our efforts to protect our trade secrets, a competitor's discovery of our proprietary technology and confidential information or other unauthorized use or disclosure would impair our competitive position and may have a material adverse effect on our business, financial condition, results of operations and prospects.

Our industry is characterized by rapid technological changes, frequent new product introductions and enhancements and evolving industry standards. These advances require us to continuously develop our technology and work to develop new solutions to keep pace with evolving standards of care. Our testing products could become obsolete unless we continually innovate and expand our testing product offerings to include new clinical applications. If we are unable to develop new testing products or to demonstrate the applicability of our testing products for other diseases, our sales could decline and our competitive position could be harmed.

The ACA made a number of substantial changes to the way healthcare is financed both by governmental and commercial payors. The ACA also introduced mechanisms to reduce the per capita rate of growth in Medicare spending if expenditures exceed certain targets. Any such reductions could affect reimbursement payments for our tests. In April 2014, Congress passed PAMA, which included substantial changes to the way in which clinical laboratory services are paid under the CLFS. Under PAMA, certain clinical laboratories are required to periodically report to CMS private payor payment rates and volumes for their tests, and laboratories that fail to report the required payment information may be subject to substantial civil monetary penalties. Medicare reimbursement for CDLTs is based on the weighted-median of the payments made by private payors for these tests, rendering private payor payment levels even more significant than in the past. As a result, future Medicare payments may fluctuate more often and become subject to the willingness of private payors to recognize the value of diagnostic tests generally and any given test individually. The impact of this payment system on rates for our tests, including any current or future tests we may develop, is uncertain. We cannot predict whether or when these or other recently enacted healthcare initiatives will be implemented at the federal or state level or how any such legislation or regulation may affect us. For instance, the payment reductions imposed by the ACA and the changes to reimbursement amounts paid by Medicare for tests such as ours based on the procedure set forth in PAMA, could limit the prices we will be able to charge or the amount of available reimbursement for our tests, which would reduce our revenue. Additionally, these healthcare laws, regulations and policies could be amended or additional healthcare initiatives could be implemented in the future. Further, the impact on our business of the expansion of the federal and state governments' role in the U.S. healthcare industry generally, including the social, governmental and other pressures to reduce healthcare costs while expanding individual benefits, is uncertain. Any future changes or initiatives could have a materially adverse effect on our business, financial condition, results of operations and cash flows.

The marketing, sale and use of our testing products could lead to liability claims if someone were to allege that any such testing product failed to perform as it was designed. We may also be subject to liability for errors in the results we provide to rheumatologists or for a misunderstanding of, or inappropriate reliance upon, the information we provide. We may also be subject to similar types of claims related to testing products we may develop in the future. Any errors or omissions or professional liability claim could result in substantial damages and be costly and time consuming for us to defend. Although we maintain professional liability insurance, we cannot assure you that our insurance would fully protect us from the financial impact of defending against these types of claims or any judgments, fines or settlement costs arising out of any such claims. Any errors or omissions or professional liability claim brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. Additionally, any product liability lawsuit could cause injury to our reputation or cause us to suspend sales of our testing products. Similarly, any product liability lawsuit affecting our partners could also cause injury to our reputation. We may also initiate a correction or removal for one of our testing products, issue a safety alert or undertake a field action or recall to reduce a risk to health posed by potential failure of our products to perform as designed, which could lead to increased costs and lead to increased scrutiny by regulatory authorities and our customers regarding the quality and safety of our testing products and to negative publicity, including safety alerts, press releases or administrative or judicial actions. The occurrence of any of these events could have an adverse effect on our business and results of operations.

Any failure or perceived failure by us to comply with federal or state laws or regulations, our internal policies and procedures or our contracts governing our use and disclosures of personal information could result in negative publicity, government investigations and enforcement actions including significant penalties, claims by third parties, and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. Failure to comply with HIPAA, the HITECH Act, their implementing regulations and similar comparable state laws and regulations affecting the transmission, security and privacy of health information could result in significant penalties. Numerous federal, state and foreign laws and regulations, including HIPAA and the HITECH Act, govern the collection, dissemination, disclosure, security, use and confidentiality of individually identifiable health information health-related and other personal information. HIPAA and the HITECH Act require us to comply with standards for the use and disclosure of PHI within our company and with third parties. The privacy, security and breach notification rules promulgated under HIPAA, as amended by the HITECH Act, Standards for Privacy of Individually Identifiable Health Information (Privacy Standards) and the Security Standards for the Protection of Electronic Protected Health Information (Security Standards) under HIPAA establish a set of basic national privacy and security standards for the protection of individually identifiable health information by Covered Entities and their Business Associates. HIPAA requires Covered Entities, such as us, to develop and maintain policies and procedures with respect to individually identifiable health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect the privacy and security of such information. HIPAA also requires us to provide individuals with certain rights with respect to their PHI. If we engage a Business Associate to help us carry out healthcare activities and functions, we must have a written Business Associate contract or other arrangement with the Business Associate that establishes specifically what the Business Associate has been engaged to do and requires the Business Associate to comply with the requirements of HIPAA. Further, in the event of a breach of unsecured PHI we must notify each individual whose PHI is breached as well as federal regulators and in some cases, must publicize the breach in local or national media. HIPAA also includes standards for common healthcare electronic transactions and code sets, such as claims information, plan eligibility, payment information and the use of electronic signatures, and privacy and electronic security of individually identifiable health information. Covered Entities, such as certain healthcare providers, are required to conform to such transaction set standards, known as the Standards for Electronic Transactions, pursuant to HIPAA. Submission of electronic healthcare claims and payment transactions that do not comply with the HIPAA electronic data transmission standards could result in delayed or denied payments. In the conduct of our business, we process, maintain, and transmit sensitive data, including PHI. There can be no assurance that a breach of privacy or security will not occur. If there is a breach, we could be subject to various lawsuits, penalties and damages and may be required to incur costs to mitigate the impact of the breach on affected individuals. Penalties for failure to comply with HIPAA requirements are substantial and could include corrective action plans and/or the imposition of civil or criminal penalties. HIPAA also authorizes state attorneys general to file suit under HIPAA on behalf of state residents. Courts can award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for HIPAA violations, its standards have been used as the basis for a duty of care claim in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may apply more broadly or be more stringent than HIPAA. For example, the CCPA, which went into effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the CPRA went into effect in California amending the CCPA and may increase our compliance costs and potential liability, imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and adds opt outs for certain uses of sensitive data. It also created a new regulatory authority, the California Privacy Protection Agency (CPPA), which is authorized to issue substantive regulations and could result in increased privacy and information security enforcement. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws (for example Virginia's Consumer Data Protection Act and other similar laws that recently went into effect in in other states, such as Utah, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas), any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. In Europe, the GDPR went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. For example, in 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the EU. In July 2023, however, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards addressing the reasons behind the Court of Justice of the EU's invalidation of the original Privacy Shield. The European Commission will continually review developments in the United States along with its adequacy decision. However, future actions of EU data protection authorities are difficult to predict. Relatedly, following the United Kingdom's withdrawal from the EU, the GDPR was implemented in the United Kingdom as the U.K. GDPR. The U.K. GDPR sits alongside the amended U.K. Data Protection Act 2018, which implements certain derogations in the EU GDPR into U.K. law. The U.K. GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. In June of 2021, the European Commission issued a decision, which will sunset on June 27, 2025 without further action, that the United Kingdom ensures an adequate level of protection for personal data transferred under the EU GDPR from the EU to the United Kingdom. The Parliament of the United Kingdom is currently considering the Data Protection and Digital Information Bill to harmonize the 2018 Data Protection Act, U.K. GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework. The regulatory framework governing the collection, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. Additionally, increasing concerns about health information privacy have recently prompted the federal government to issue guidance taking a newly expansive view of the scope of the laws and regulations that they enforce. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our privacy policies, changing expectations, evolving laws, rules and regulations, industry standards or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation and adversely affect our business and results of operations.

If demand for our testing products or any of our future testing products or solutions grows, we will need to continue to scale our testing capacity and processing technology, expand customer service, billing and systems processes and enhance our internal quality assurance program. We may also need additional certified laboratory scientists and other scientific and technical personnel to process higher volumes of our testing products. We cannot assure you that any increases in scale, related improvements and quality assurance will be successfully implemented or that appropriate personnel will be available. We will also need to purchase additional equipment, some of which can take several months or more to procure, setup and validate, and increase our software and computing capacity to meet increased demand. Failure to implement necessary procedures, transition to new processes, hire the necessary personnel, obtain any necessary additional equipment and increase software and computing capacity could result in higher costs of processing tests or inability to meet demand. There can be no assurance that we will be able to perform our testing on a timely basis at a level consistent with demand, or that our efforts to scale our operations, expand our personnel, equipment, software and computing capacities, or implement process enhancements will be successfully implemented and will not negatively affect the quality of test results. In addition, there can be no assurance that we will have adequate space in our laboratory facility to accommodate such required expansion. We are also currently collaborating with third parties in an effort to implement multiplex technology in our laboratory. We may experience difficulties securing a partner for this technology and integrating such technology into our existing laboratory operations, which could affect our ability to meet demand for our testing products. If we encounter difficulty meeting market demand or quality standards, our reputation could be harmed and our future prospects and our business could suffer.

Successful commercialization of our testing products depends, in large part, on the availability of coverage and adequate reimbursement from third-party payors, including government payors, such as Medicare and Medicaid and commercial payors. For the testing products that we develop and commercialize, each third-party payor decides whether to cover the product, the amount it will reimburse for a covered product and the specific conditions for reimbursement. Reimbursement by third-party payors may depend on a number of factors, including the payor's determination that tests using our technologies are: - not experimental or investigational;- medically necessary;- demonstrated to lead to improved patient outcomes;- appropriate for the specific patient;- cost-saving or cost-effective;- supported by peer-reviewed medical journals; and - included in clinical guidelines. If we are unable to provide third-party payors with sufficient evidence of the clinical utility and validity of our test, they may not provide coverage, or may provide limited coverage, which will adversely affect our revenue and our ability to succeed. In addition, clinicians may be less likely to order a test unless third-party payors pay a substantial portion of the test price. Therefore, coverage determinations and reimbursement levels and conditions are critical to commercial success, and if we are not able to secure positive coverage determinations and reimbursement levels, our business will be materially adversely affected. Third-party payors and other entities also conduct technology assessments of new medical tests and devices and provide and/or sell the results of their assessments to other parties. These assessments may be and have been used by third-party payors and healthcare providers as grounds to deny coverage for or refuse to use a test or procedure, including our tests. In addition, third-party payors have increased their efforts to control the cost, utilization and delivery of healthcare services. These measures have resulted in reduced payment rates and decreased utilization for the diagnostics industry. Effective April 25, 2012, Palmetto GBA, the Medicare MolDx Program, assigned the AVISE MTX assay a unique identifier and determined that the test meets the applicable Medicare coverage criteria to support dose optimization and therapeutic decision making for patients diagnosed with RA on methotrexate. Our current Medicare Administrative Contractor, Noridian, has adopted this coverage policy. In addition, and effective April 1, 2022, CMS agreed to recognize a new PLA code for our protein-based test, AVISE Lupus. Noridian priced this PLA code at $1,085 per test. To determine pricing beyond 2022, CMS recommended crosswalking AVISE Lupus (0312U) to Vectra (81490) at a rate of $840.65 per test. This pricing was finalized on the 2023 CLFS and is effective from January 1, 2023 through December 31, 2025. A pricing determination is not synonymous with a coverage determination. Having a price associated with the PLA code for any particular test does not secure coverage or reimbursement for that PLA code from Medicare or any other third-party payor. So, in an effort to improve transparency regarding Medicare support of AVISE Lupus, we submitted a formal request to Noridian for coverage of our AVISE Lupus test under the new PLA Code. On September 27, 2022, we received notice that Noridian has deemed our application for an LCD to be valid. Ultimately receiving a favorable LCD is uncertain and may be time-consuming, resource intensive and require multiple quarterly or annual periods to complete. We have faced and may again face or continue to face challenges relating to commercial payor claim processing and revenue with our tests. Other third-party payors make their own decisions as to whether to establish a policy to reimburse our testing products. Because approvals must be sought on a payor-by-payor basis, establishing broad coverage is a time-consuming and costly process. There are many third-party payors who have not yet established a coverage policy applicable to our testing products. In addition, several commercial payors issued non-coverage policies with respect to AVISE Lupus, determining that AVISE Lupus does not meet the medical criteria for coverage and is considered investigational and/or experimental. While our testing products are reimbursed by a number of third-party payors, we do not currently have contracts with significant private payors. We have in the past, and will likely in the future, experience delays and temporary interruptions in the receipt of payments from third-party payors due to changes in their internal processes, documentation requirements and other issues, which could cause our revenue to fluctuate from period to period. If we are not successful in reversing existing non-coverage policies, or if other third-party payors issue negative coverage policies, these policies could have a material adverse effect on our business and operations. Even if many third-party payors currently reimburse for our testing products, such payors have in the past and may again withdraw coverage at any time, review and adjust the rate of reimbursement, require co-payments from patients or stop paying for our testing products altogether, any of which could materially reduce our revenue.

We currently derive all of our revenue from tests conducted at a single laboratory facility located in Vista, California. Vista is situated on or near earthquake fault lines. Our facility and equipment could be harmed or rendered inoperable by natural or man-made disasters which may be exacerbated due to climate change, including earthquake, fire, flood, power loss, communications failure or terrorism, or public health crises. In particular, we store all of our flow cytometers, the instrument we use to detect CB-CAPs on cells, at our Vista facility. If all of our flow cytometers were rendered inoperable simultaneously pursuant to a natural or man-made disaster, we would be unable to perform these key tests as we do in the ordinary course of our business. The inability to perform the tests contained in our testing products or to reduce the backlog of analyses that could develop if our facility is inoperable, for even a short period of time, may result in the loss of customers or harm to our reputation, and we may be unable to regain those customers or repair our reputation in the future. Additionally, we store our bio-repository of specimens, which were collected in collaboration with leading academic institutions and help us to further validate our testing products, at our Vista facility. If these specimens were destroyed pursuant to a natural or man-made disaster or otherwise become unavailable, our ability to develop new testing products may be delayed. Furthermore, our facility and the equipment we use to perform our research and development work could be unavailable or costly and time-consuming to repair or replace. It would be difficult, time-consuming and expensive to rebuild our facility or license or transfer our proprietary technology to a third party, particularly in light of the licensure and accreditation requirements for a commercial laboratory like ours. Even in the unlikely event we are able to find a third party with such qualifications to enable us to conduct the tests contained in our testing products, we may be unable to negotiate commercially reasonable terms. In order to rely on a third party to perform the tests contained in our testing products (even assuming we are able to do so in compliance with applicable regulations), we would need to engage another facility with established state licensure and CLIA certification under the scope of which tests could be performed following validation and other required procedures. We cannot assure you that we would be able to find another CLIA-certified facility willing to comply with the required procedures, that any such facility would be willing to perform the tests contained in our testing products for us on commercially reasonable terms, or that it would be able to meet our quality standards. In order to establish additional clinical reference laboratory facilities, we have to spend considerable time and money securing adequate space, which may include constructing additional facilities, recruiting and training employees, and establishing the additional operational and administrative infrastructure necessary to support a second facility. We may not be able, or it may take considerable time, to replicate our testing processes or results in any new or converted facility. Additionally, any new clinical reference laboratory facility opened by us would be subject to certification under CLIA and licensing by several states, including, as applicable, California and New York, which could take a significant amount of time and result in delays in our ability to begin operations. We believe we have the capacity to meet our projected needs for at least the next 12 months, although we may grow at a rate that is faster than we expect. We may need to further expand our laboratory space in the future. Any future expansion could disrupt laboratory operations, resulting in an inability to meet customer turnaround time expectations, and could be delayed, resulting in slower realization of laboratory efficiencies anticipated from the use of the expanded facilities. Adverse consequences resulting from a delay in the laboratory expansion could harm our relationships with our customers and our reputation, and could affect our ability to generate revenue. We carry insurance for damage to our property and the disruption of our business, but this insurance may not cover all the risks associated with damage or disruption to our business, provide coverage in amounts sufficient to cover our potential losses or continue to be available to us on acceptable terms, if at all.

Our success depends largely on the skills, experience and performance of key members of our executive management team, including John Aballi, our President and Chief Executive Officer, and others in key management positions. The efforts of each of these persons will be critical to us as we continue to develop our technologies and test processes and focus on our growth. If we were to lose one or more of these key employees, we may experience difficulties in competing effectively, developing our technologies and implementing our business strategy. In addition, our research and development programs and commercial laboratory operations depend on our ability to attract and retain highly skilled scientists, including licensed clinical laboratory scientists and biostatisticians. We may not be able to attract or retain qualified scientists and technicians in the future due to the intense competition for qualified personnel among life science businesses, particularly in Southern California. Because it is expected that there will be a shortage of clinical laboratory scientists in coming years, it may become more difficult to hire sufficient numbers of qualified personnel. We also face competition from universities and public and private research institutions in recruiting and retaining highly qualified scientific personnel. Additionally, our success depends on our ability to attract and retain qualified and highly-specialized salespeople. We may have difficulties locating, recruiting or retaining qualified salespeople, which could cause a delay or decline in the rate of adoption of our testing products. If we are not able to attract and retain the necessary personnel to accomplish our business objectives, we may experience constraints that could adversely affect our ability to support our research and development, clinical laboratory and sales efforts. All of our employees are at-will, which means that either we or the employee may terminate their employment at any time.

Expedited, reliable shipping is essential to our operations. We have been utilizing both United Parcel Service and Federal Express Corporation (Federal Express) for reliable and secure point-to-point transport of patient specimens to our laboratory and enhanced tracking of these patient specimens. Should Federal Express, United Parcel Service, or any other carrier we may use in the future, encounter delivery performance issues such as loss, damage or destruction of a specimen, it may be difficult to replace our patient specimens in a timely manner and such occurrences may damage our reputation and lead to decreased utilization from rheumatologists for our testing services and increased cost and expense to our business. In addition, any significant increase in shipping time or disruption to delivery service, whether due to bad weather, natural disaster (which may be exacerbated due to climate change), public health epidemics or pandemics, terrorist attacks or threats, labor strikes, work stoppages or boycotts, or for other reasons, could adversely affect our ability to receive and process patient specimens on a timely basis. If we, Federal Express, or United Parcel Service were to terminate our relationship, we would be required to find another party to provide expedited, reliable point-to-point transport of our patient specimens. There are only a few other providers of such nationwide transport services, and there can be no assurance that we will be able to enter into arrangements with such other providers on acceptable terms, if at all. Finding a new provider of transport services would be time-consuming and costly and result in delays in our ability to provide our testing services. Even if we were to enter into an arrangement with any such provider, there can be no assurance that they will provide the same level of quality in transport services currently provided to us by Federal Express and United Parcel Service. If any new provider does not provide, or if Federal Express or United Parcel Service does not continue to provide, the required quality and reliability of transport services at the same or similar costs, it could materially and adversely affect our business, reputation, results of operations and financial condition.

Our operations could be subject to earthquakes, power shortages, telecommunications failures, water shortages, floods, hurricanes, typhoons, fires, extreme weather conditions, medical epidemics, political instability, acts of war, including the current conflict in Ukraine and the Middle East, and other natural or manmade disasters (which may be exacerbated due to climate change) or business interruptions, for which we are predominantly self-insured. We rely on third-party manufacturers to produce our testing products. Our ability to obtain clinical supplies of our testing products could be disrupted if the operations of these suppliers were affected by a man-made or natural disaster or other business interruption. In addition, our corporate headquarters is located in Vista, California near major earthquake faults and fire zones, and the ultimate impact on us of being located near major earthquake faults and fire zones and being consolidated in a certain geographical area is unknown. The occurrence of any of these business disruptions could seriously harm our operations and financial condition and increase our costs and expenses.